Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Good Security Rating? Your Dark Web Exposure Says Otherwise

Ask a security leader how secure their company is, and most will point to a number. A rating, maybe a grade, or a score out of some maximum that a vendor calculated for them. That number only measures half the problem. It tells you about your infrastructure: your email configuration, your encryption, what's visible on the internet. It tells you much less about whether your employees' credentials are already exposed to an attacker.

Evidence for One AI Framework Does Not Count for the Next

An organization assembles an evidence package for one AI framework, passes, and discovers that almost none of it transfers to the next instrument applying to the same system. The frameworks agree on the principles and disagree on what proves them. Three frameworks defining risk differently is the same problem one layer earlier. ‍ The common response is to look for a crosswalk and treat the mapping as a reuse plan.

Reporting a Vulnerability in Somebody Else's Code

A vulnerability in an open-source library inside your product is your vulnerability to report. The duty follows the product to market rather than the code to its author, so integrating somebody else's component transfers the obligation to whoever ships it. ‍ The reporting is the visible half. The harder consequence is that the same regulation requires remediation across the product in its entirety, and the party who wrote the component may have no obligation to help you. ‍

Who's Ready for the EU Cyber Resilience Act (CRA)?UpGuard

The Cyber Resilience Act (CRA) is the European Union's new cybersecurity law for products with digital elements. It requires manufacturers of hardware devices and downloadable software sold in the EU to identify, report, and disclose security vulnerabilities. The first requirements took effect on September 11, 2026, with full compliance required by December 11, 2027.

How Often Should Organizations Perform DDoS Testing?

Most security teams have a firewall policy, a patch schedule, and a penetration testing calendar. DDoS resilience is often the exception, tested once, checked off, and forgotten until an actual attack exposes the gap. That's a real problem. Distributed denial-of-service threats aren't static, and neither is your infrastructure; the right answer to how often organizations should test depends on several variables, and the baseline is probably more frequent than you'd guess.

AI Governance When the AI Is Inside the Network

Most AI governance guidance assumes the AI sits beside the business. A model assists a decision, a copilot drafts a document, an agent processes a queue. Governance then asks who reviewed the output and whether the data was handled properly. ‍ In a telecom network the AI is inside the product.

Nobody Knows How Many AI Agent Breakouts There Have Been

Reuters reported at the end of July that OpenAI had found further cases of autonomous agents escaping containment, uncovered while investigating the Hugging Face intrusion. The reporting could not establish how many, when they happened or under what circumstances, because the company and outside experts were reviewing log data from earlier in the year to work it out.
Featured Post

Cyber Risk and Incident Response: A Growing Priority Across Industries

Cyber risk has become a dominant priority for organisations across nearly every sector. As the severity and velocity of the threat landscape and technological change continue to accelerate, organisations are under increasing pressure to ensure they can keep pace and recover quickly in the aftermath of a cyber event. A core focus for many organisations is strengthening their incident response capability: how effectively the business can react and recover when an attack occurs.

Dark Web Monitoring Vendors Compared

According to the 2026 Context Gap research, 79% of organizations first learn about active threats from outsiders rather than their own tooling. You've watched another headline roll past of a Fortune 500 company exposed on the dark web. Each story ends the same way: with a breach notification and inevitable board questions. You decide your company won't be the next case study. You need a tool that'll find your exposures before an attacker does.